e3f67f
From e3da68be55914bfeedb8866f191cc0958579611d Mon Sep 17 00:00:00 2001
e3f67f
From: Josh Boyer <jwboyer@fedoraproject.org>
e3f67f
Date: Wed, 13 Nov 2013 10:21:18 -0500
e3f67f
Subject: [PATCH] Revert "userns: Allow unprivileged users to create user
e3f67f
 namespaces."
e3f67f
e3f67f
This reverts commit 5eaf563e53294d6696e651466697eb9d491f3946.
e3f67f
e3f67f
Conflicts:
e3f67f
	kernel/fork.c
e3f67f
---
e3f67f
 kernel/fork.c | 13 +++++++++++++
e3f67f
 1 file changed, 13 insertions(+)
e3f67f
e3f67f
diff --git a/kernel/fork.c b/kernel/fork.c
e3f67f
index f6d11fc..e04c9a7 100644
e3f67f
--- a/kernel/fork.c
e3f67f
+++ b/kernel/fork.c
e3f67f
@@ -1573,6 +1573,19 @@ long do_fork(unsigned long clone_flags,
e3f67f
 	long nr;
e3f67f
 
e3f67f
 	/*
e3f67f
+	 * Do some preliminary argument and permissions checking before we
e3f67f
+	 * actually start allocating stuff
e3f67f
+	 */
e3f67f
+	if (clone_flags & CLONE_NEWUSER) {
e3f67f
+		/* hopefully this check will go away when userns support is
e3f67f
+		 * complete
e3f67f
+		 */
e3f67f
+		if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SETUID) ||
e3f67f
+				!capable(CAP_SETGID))
e3f67f
+			return -EPERM;
e3f67f
+	}
e3f67f
+
e3f67f
+	/*
e3f67f
 	 * Determine whether and which event to report to ptracer.  When
e3f67f
 	 * called from kernel_thread or CLONE_UNTRACED is explicitly
e3f67f
 	 * requested, no event is reported; otherwise, report if the event
e3f67f
-- 
e3f67f
1.8.3.1
e3f67f